devshield-scanner 0.1.0__tar.gz → 0.1.1__tar.gz

{devshield_scanner-0.1.0/devshield_scanner.egg-info → devshield_scanner-0.1.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devshield-scanner
-Version: 0.1.0
+Version: 0.1.1
 Summary: Read-only Linux host and Docker filesystem inspection using ClamAV
 License-Expression: MIT
 Classifier: Development Status :: 3 - Alpha
@@ -14,7 +14,9 @@ Dynamic: license-file
 
 # DevShield for Linux
 
-An installable Python CLI package is included. See **INSTALL.md** to build a wheel and install the `devshield` command on servers using an isolated environment under `/opt/devshield`. There is no published npm or Python registry package yet. `devshield --version` displays the CLI version; existing scanner flags are unchanged.
+An installable Python CLI package is included. The Python distribution is `devshield-scanner`; the command is `devshield`. See **INSTALL.md** for isolated installation under `/opt/devshield`. `devshield --version` displays the CLI version.
+
+Version 0.1.1 enables ClamAV scan-limit alerts and marks zero-data scans, missing summaries and logged warnings/errors as incomplete coverage (exit 2), even when ClamAV returns 0. Limit alerts are not proof of malware. Optional `--max-filesize-mb` and `--max-scansize-mb` override engine limits in MB. Increasing limits can increase memory, CPU and runtime; engine hard limits still apply. A positive data count alone does not prove every archive entry was inspected.
 
 Read-only host and Docker filesystem malware scanning using the locally installed ClamAV signature engine. Requires Linux, Python 3.8+, `clamscan`, updated ClamAV databases, and the Docker CLI for container scanning. Run on the Docker host with a local Unix socket context. Root access normally provides the required file/socket access.
 

{devshield_scanner-0.1.0 → devshield_scanner-0.1.1}/README.md

@@ -1,6 +1,8 @@
 # DevShield for Linux
 
-An installable Python CLI package is included. See **INSTALL.md** to build a wheel and install the `devshield` command on servers using an isolated environment under `/opt/devshield`. There is no published npm or Python registry package yet. `devshield --version` displays the CLI version; existing scanner flags are unchanged.
+An installable Python CLI package is included. The Python distribution is `devshield-scanner`; the command is `devshield`. See **INSTALL.md** for isolated installation under `/opt/devshield`. `devshield --version` displays the CLI version.
+
+Version 0.1.1 enables ClamAV scan-limit alerts and marks zero-data scans, missing summaries and logged warnings/errors as incomplete coverage (exit 2), even when ClamAV returns 0. Limit alerts are not proof of malware. Optional `--max-filesize-mb` and `--max-scansize-mb` override engine limits in MB. Increasing limits can increase memory, CPU and runtime; engine hard limits still apply. A positive data count alone does not prove every archive entry was inspected.
 
 Read-only host and Docker filesystem malware scanning using the locally installed ClamAV signature engine. Requires Linux, Python 3.8+, `clamscan`, updated ClamAV databases, and the Docker CLI for container scanning. Run on the Docker host with a local Unix socket context. Root access normally provides the required file/socket access.
 

{devshield_scanner-0.1.0 → devshield_scanner-0.1.1}/devshield_linux.py

@@ -14,9 +14,30 @@ import tempfile
 import time
 
 
+def coverage_warnings(log_path):
+    """Read logs incrementally; a zero exit code alone does not establish coverage."""
+    warnings = set()
+    summary = False
+    with open(log_path, encoding='utf-8', errors='replace') as log:
+        for line in log:
+            if 'Data scanned:' in line:
+                summary = True
+                if re.search(r'Data scanned:\s*0(?:[.,]0+)?\s', line):
+                    warnings.add('ClamAV reported zero data scanned; coverage is unverified.')
+            if 'Heuristics.Limits.Exceeded' in line or 'Heuristics.Encrypted.' in line:
+                warnings.add('Scan limit or encrypted-content alert; some content was not inspected.')
+            if re.search(r'\b(?:WARNING|ERROR):', line) or re.search(r'Total errors:\s*[1-9]', line):
+                warnings.add('ClamAV reported warnings/errors; inspect the stage log.')
+    if not summary:
+        warnings.add('ClamAV scan summary missing; coverage is unverified.')
+    return sorted(warnings)
+
+
 def main():
     parser = argparse.ArgumentParser(description=__doc__)
-    parser.add_argument('--version', action='version', version='DevShield 0.1.0')
+    parser.add_argument('--version', action='version', version='DevShield 0.1.1')
+    parser.add_argument('--max-filesize-mb', type=int, help='ClamAV per-file limit in MB (default: engine setting)')
+    parser.add_argument('--max-scansize-mb', type=int, help='ClamAV archive scan limit in MB (default: engine setting)')
     parser.add_argument('--host-root', default='/', help='Host directory to scan (default /)')
     parser.add_argument('--skip-host', action='store_true')
     parser.add_argument('--skip-docker', action='store_true')
@@ -28,6 +49,9 @@ def main():
         parser.error('Run this script on Linux.')
     if args.heartbeat < 1:
         parser.error('--heartbeat must be positive')
+    for value in (args.max_filesize_mb, args.max_scansize_mb):
+        if value is not None and value < 1:
+            parser.error('Scan size limits must be positive MB values')
     if not shutil.which('clamscan'):
         parser.error('clamscan is missing. Install ClamAV and update its databases first; see README.md.')
     report_dir = Path(args.reports).resolve() / (dt.datetime.now(dt.timezone.utc).strftime('%Y%m%dT%H%M%SZ') + '-' + str(os.getpid()))
@@ -81,12 +105,21 @@ def main():
     scratch = tempfile.TemporaryDirectory(prefix='devshield-', dir=args.temp_dir)
     def scan(path, label, excludes=()):
         command = ['clamscan', '--recursive=yes', '--infected', '--verbose', '--scan-archive=yes',
-                   '--cross-fs=yes', '--follow-dir-symlinks=0', '--follow-file-symlinks=0']
+                   '--cross-fs=yes', '--follow-dir-symlinks=0', '--follow-file-symlinks=0', '--alert-exceeds-max=yes']
+        if args.max_filesize_mb is not None:
+            command.append(f'--max-filesize={args.max_filesize_mb}M')
+        if args.max_scansize_mb is not None:
+            command.append(f'--max-scansize={args.max_scansize_mb}M')
         command.extend('--exclude-dir=^' + re.escape(str(Path(p).resolve())) + r'(/|$)' for p in excludes)
         rc, log = run([*command, '--', str(path)], label)
+        warnings = coverage_warnings(log)
         report['scans'].append({'target': str(path), 'label': label, 'exit_code': rc, 'log': log,
-                                'result': {0: 'No signature detections reported', 1: 'Detection reported'}.get(rc, 'Scan error')})
+                                'coverage_warnings': warnings,
+                                'result': ('Incomplete coverage; review log' if warnings else
+                                           {0: 'No signature detections reported', 1: 'Detection reported'}.get(rc, 'Scan error'))})
         save()
+        for warning in warnings:
+            issue(f'{label}: {warning} See {log}')
         if rc not in (0, 1):
             issue(f'{label}: ClamAV failed; see {log}')
     save()

{devshield_scanner-0.1.0 → devshield_scanner-0.1.1/devshield_scanner.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devshield-scanner
-Version: 0.1.0
+Version: 0.1.1
 Summary: Read-only Linux host and Docker filesystem inspection using ClamAV
 License-Expression: MIT
 Classifier: Development Status :: 3 - Alpha
@@ -14,7 +14,9 @@ Dynamic: license-file
 
 # DevShield for Linux
 
-An installable Python CLI package is included. See **INSTALL.md** to build a wheel and install the `devshield` command on servers using an isolated environment under `/opt/devshield`. There is no published npm or Python registry package yet. `devshield --version` displays the CLI version; existing scanner flags are unchanged.
+An installable Python CLI package is included. The Python distribution is `devshield-scanner`; the command is `devshield`. See **INSTALL.md** for isolated installation under `/opt/devshield`. `devshield --version` displays the CLI version.
+
+Version 0.1.1 enables ClamAV scan-limit alerts and marks zero-data scans, missing summaries and logged warnings/errors as incomplete coverage (exit 2), even when ClamAV returns 0. Limit alerts are not proof of malware. Optional `--max-filesize-mb` and `--max-scansize-mb` override engine limits in MB. Increasing limits can increase memory, CPU and runtime; engine hard limits still apply. A positive data count alone does not prove every archive entry was inspected.
 
 Read-only host and Docker filesystem malware scanning using the locally installed ClamAV signature engine. Requires Linux, Python 3.8+, `clamscan`, updated ClamAV databases, and the Docker CLI for container scanning. Run on the Docker host with a local Unix socket context. Root access normally provides the required file/socket access.
 

{devshield_scanner-0.1.0 → devshield_scanner-0.1.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "devshield-scanner"
-version = "0.1.0"
+version = "0.1.1"
 description = "Read-only Linux host and Docker filesystem inspection using ClamAV"
 readme = "README.md"
 requires-python = ">=3.8"